System and method of volume health checking and recovery

ABSTRACT

A system of volume health checking and recovery. The system comprises a health engine capable to check the health of a first volume that is a snapshot mirrored volume of a second volume; and a recovery engine, communicatively coupled to the health engine, capable to perform a recovery process if the first volume is unhealthy. Recovery can be performed via at least one of five methods.

CROSS-REFERENCE TO RELATED APPLICATION

This is a Continuation of U.S. application Ser. No. 10/140,581 filed May7, 2002; the entire disclosure of which is hereby incorporated byreference.

TECHNICAL FIELD

This invention relates generally to volume health checking and recovery,and more particularly, but not exclusively, provides a system and methodfor non-disruptive volume health checking and recovery.

BACKGROUND

Servers, such as database servers, email servers, file servers, and soforth, hold large amounts of data. Checking the health of this data maydisrupt online services on the servers because it requires a lot of isCPU power and places a strain on the storage system. Disruption ofservices leads to slower system performance causing inconvenience forusers and administrators. Accordingly, a new system and method is neededthat enables volume health checking without placing a strain on thestorage system and using a lot of CPU power.

SUMMARY

The present invention provides a system for volume health checking andrecovery without disrupting online services. The system comprises aproduction server, a production volume, a backup management server and asnapshot mirrored volume. The production server includes an applicationthat stores and accesses data on the production volume. The productionserver also includes an agent that manages communication between theproduction server and the backup management server. The agent also takessnapshots of the production volume. The production volume includes alogical volume used by the application and is mirrored by the snapshotmirrored volume.

The backup management server includes a manager, a health check andclean up function, and a backup table. The manager communicates with theagent and manages configuration of the snapshot mirrored volume and thebackup table. In addition, the manager uses the health check and cleanup function to check the health of the mirrored snapshot volume, therebyavoiding the need to check the health of the production volume. If themirrored snapshot volume is unhealthy (e.g., individual files or thevolume itself have data corruption problems, viruses, etc.), the managercan use the health check and clean up function to repair the damage(e.g., data corruption, viruses, etc.) to the mirrored snapshot volumeand/or production via several techniques. The backup table includesinformation on the production volume and mirrored snapshot volume, suchas file system hostname, etc.

The present invention further provides a method for volume health checkand recovery. The method comprises gathering information on a targetproduction volume; performing preprocessing for splitting a mirroredpair; splitting the mirrored pair; mounting a snapshot mirrored volumeon the backup server, if necessary; running a health check; alerting anadministrator if the health check uncovers a problem; performing arecovery process if the health check indicates a problem; and performingpost-processing including unmounting the mounted volume andresynchronizing.

The recovery process, when required, can be performed via at least fivedifferent techniques. The first technique includes repairing unhealthyfiles on the mirrored snapshot volume and then copying the repairedfiles to the production volume. The second technique includes repairingan unhealthy volume and then resynchronizing the mirrored pair. Thethird technique includes copying healthy files from a second snapshotmirrored volume to the production volume. The fourth technique includesrepairing the unhealthy files on the production volume. The fifthtechnique includes resynchronizing the production volume with a secondsnapshot mirrored volume that is healthy.

Accordingly, the system and method advantageously enables the healthchecking of volumes and recovery with little or no disruption of onlineservices.

BRIEF DESCRIPTION OF THE DRAWINGS

Non-limiting and non-exhaustive embodiments of the present invention aredescribed with reference to the following figures, wherein likereference numerals refer to like parts throughout the various viewsunless otherwise specified.

FIG. 1 is a block diagram illustrating a volume health check system;

FIG. 1-2 is a block diagram illustrating an example computer for usewith the present invention;

FIG. 2 is flow diagram illustrating volume health checking;

FIG. 3-1 is a flow diagram illustrating recovery according to a firstembodiment of the invention;

FIG. 3-1-1 is a flow diagram illustrating recovery according to a secondembodiment of the invention;

FIG. 3-2 is a flow diagram illustrating recovery according to a thirdembodiment of the invention;

FIG. 3-3 is a flow diagram illustrating recovery according to a fourthembodiment of the invention;

FIG. 3-4 is a flow diagram illustrating recovery according to a fifthembodiment of the invention;

FIG. 4 is a flowchart illustrating a method for volume health check andrecovery;

FIG. 5 is a flowchart illustrating a method for recovery using the firstand second embodiments;

FIG. 6 is a flowchart illustrating a method for recovery using the thirdand fourth embodiments;

FIG. 7 is a flowchart illustrating a method for recovery using the fifthembodiment; and

FIG. 8 is a diagram illustrating a backup table.

DETAILED DESCRIPTION OF THE ILLUSTRATED EMBODIMENTS

The following description is provided to enable any person skilled inthe art to make and use the invention, and is provided in the context ofa particular application and its requirements. Various modifications tothe embodiments will be readily apparent to those skilled in the art,and the principles defined herein may be applied to other embodimentsand applications without departing from the spirit and scope of theinvention. Thus, the present invention is not intended to be limited tothe embodiments shown, but is to be accorded the widest scope consistentwith the principles, features and teachings disclosed herein.

FIG. 1 is a block diagram illustrating a volume health check system 100.System 100 includes a plurality of production servers, such asproduction server 1000, with corresponding production volumes, such asproduction volume 1050, and a backup management server 1070 withcorresponding snapshot mirrored volumes, such as volumes 1110 and 1120.The production servers are communicatively coupled to production volumesusing logical data connections, such as connection 1040, that mayinclude switches, HBAs, disk subsystem ports, etc. Connection protocolsbetween the production servers and production volumes may include FibreChannel, SCSCI, FC over IP, etc. In addition, each production volume iscommunicatively coupled to at least two snapshot mirrored volumes vialogical data connections that can be substantially similar to thelogical data connections between production servers and productionsvolumes. (In another embodiment, each production volume iscommunicatively coupled to a single snapshot mirrored volume.) Forexample, production volume 1050 is communicatively coupled to snapshotmirrored volumes 1120 and 1160 via logical data connections 1140 and1130 respectively.

The production servers are also communicatively coupled to the backupmanager server 1070 via logical connections, such as logical connection1150, and also to the snapshot mirrored volumes via logical connections,such as logical connection 1060. In addition, backup management server1070 is communicatively coupled to snapshot mirrored volumes via logicalconnections, such as logical connection 1100.

Each production server includes an agent 1010 and at least oneapplication 1020. In an embodiment of the invention, production serverscan also include a health check and clean up function 1090 b (FIG. 3-4).Agent 1010 manages communication to the backup management server 1070,takes snapshots of production volumes, and communicates with application1020 for pre-process and post-process snapshot purposes. In anembodiment of the invention, the agent 1010 also checks the health offiles on production volumes and/or checks the health of the productionvolumes themselves by invoking health check and clean up function 1090b, which may comprise a health check engine and a clean up engine. Inanother embodiment of the invention, the agent 1010 can repair files onthe production volume and/or repair the production volumes themselves byinvoking health check and clean up function 1090 b. Application 1020includes an application stores and accesses data on a production volume.For example, application 1020 may include a database manager.

Production volumes, such as production volume 1050, are logical volumesthat are used by application 1020. The production volumes may include asingle physical disk drives, multiple disk drives wherein a disk arraycontroller strips manages the data across various disk drives, or anyother type of logical volume.

Backup management server 1070 includes a manager 1080, a health checkand clean up function 1090, and a backup table 1095. Manager 1080manages the configuration of mirroring pair and backup table 1095.Further, the manager 1080 manages, using function 1090, the health checkand clean up of snapshot mirrored volumes and/or individual files on thesnapshot mirrored volumes. In addition, the manager 1080 communicateswith agent 1010 via logical link 1150.

The health check and clean up function 1090 may include an engine orengines (e.g., a health check engine and a clean up engine) for checkingvolume and/or file health in the snapshot mirrored volumes. In addition,the health check and clean up function 1090 can clean up (e.g., recover,repair, etc.) unhealthy volumes and/or files if necessary. Health checksand associated repairs can be for database corruption, virus removal,and/or other problems.

Backup table 1095 includes information on mirrored pair volumes, such aswhen each one was suspended (e.g., backed up); what type of file systemeach volume uses; associated hostname; mount point; application, etc.Backup table 1095 will be discussed in further detail in conjunctionwith FIG. 8.

FIG. 1-2 is a block diagram illustrating an example computer 400 inaccordance with the present invention. In an embodiment of theinvention, the backup management server 1070 and/or production server1000 may include or be resident on a computer that is substantiallysimilar to example computer 400. The example computer 400 includes acentral processing unit (“CPU”) 405; working memory 410; persistentmemory 420; network interface 430; display 440 and input device 450, allcommunicatively coupled to each other via system bus 460. CPU 405 aprocessor capable to execute software stored in persistent memory 420.Working memory 410 may include random access memory (“RAM”) or any othertype of read/write memory devices or combination of memory devices.Persistent memory 420 may include a hard drive, read only memory (“ROM”)or any other type of memory device or combination of memory devices thatcan retain data after example computer 400 is shut off. Networkinterface 430 is communicatively coupled, via wired or wirelesstechniques, to logical connections, such as logical data connections1040, 1100, and 1060, etc. Display 440 includes a liquid crystal display(“LCD”) display, cathode ray tube display or other display device. Inputdevice 450 includes a keyboard, mouse, or other device for inputtingdata, or a combination of devices for inputting data.

One skilled in the art will recognize that the example computer 400 mayalso include additional devices, such as network connections, additionalmemory, additional processors, LANs, input/output lines for transferringinformation across a hardware channel, the Internet or an intranet, etc.One skilled in the art will also recognize that the programs and datamay be received by and stored in the system in alternative ways.

FIG. 2 is flow diagram illustrating volume health checking. In order tocheck the health of production volume 1050 without disrupting services,such as application 1020, that requires access to production volume1050, agent 1010 splits the mirrored pair (i.e., production volume 1050and snapshot mirrored volume 1110) and the health check and clean upfunction 1090 performs a health check (e.g., volume health check, viruscheck, etc.) on snapshot mirrored pair 1110, which is identical incontents to production volume 1050. Accordingly, a problem in productionvolume 1050 will be indicated by a problem in snapshot mirrored volume1110. Health checking will be discussed in further detail in conjunctionwith FIG. 4 below.

FIG. 3-1 is a flow diagram illustrating recovery according to a firstembodiment of the invention. If a health check, as described inconjunction with FIG. 2 above, indicates that an unhealthy snapshotvolume 1110 cannot be cleaned up (e.g., data corruption cannot becorrected, viruses cannot be removed, etc.) then manager 1080 chooses ahealthy snapshot mirrored volume 1120 for resynchronization and forwardsdata identifying volume 1120 to agent 1010 so that agent 1010 canperform the resynchronization with production volume 1050 and healthysnapshot mirrored volume 1120. Accordingly, this recovery techniquelimits disruption to production volume 1050. This first embodimentrecovery technique will be discussed in further detail in conjunctionwith FIG. 5.

FIG. 3-1-1 is a flow diagram illustrating recovery according to a secondembodiment of the invention. If a health check indicates that snapshotmirrored volume 1110 is unhealthy but can be cleaned up then healthcheck and clean up function 1090 cleans up (e.g., removes viruses, fixesdata corruption etc.) the unhealthy snapshot mirrored volume 1110.Manager 1080 then notifies agent 1010 that snapshot mirrored volume 1110has been cleaned up. Agent 1010 can then resynchronize production volume1050 with mirrored snapshot volume 1110, thereby correcting any problemswith production volume 1050 and limiting access disruption. This secondembodiment recovery technique will also be discussed in further detailin conjunction with FIG. 5.

FIG. 3-2 is a flow diagram illustrating recovery according to a thirdembodiment of the invention. If individual unhealthy files can becleaned, then manager 1080 invokes the health check and clean upfunction 1090 to clean the unhealthy files. For example, cleaning mayinclude virus removal from files. Manager 1080 then informs agent 1010of the cleaned up files. Agent 1010 can then copy the cleaned files tothe production volume 1050 to replace the corresponding unhealthy fileson the production volume 1050 thereby correcting any unclean files onthe production volume 1050. This third embodiment will be discussed infurther detail in conjunction with FIG. 6.

FIG. 3-3 is a flow diagram illustrating recovery according to a fourthembodiment of the invention. If individual unhealthy files cannot becleaned, then manager 1080 selects healthy files from a healthy snapshotmirrored volume 1120. Manager 1080 then informs agent 1010 of thelocation of these files. Agent 1010 can then copy the files from volume1120 to the production volume 1050 to replace the correspondingunhealthy files on the production volume 1050 thereby correcting anyunclean files on the production volume 1050. This fourth embodiment willbe discussed in further detail in conjunction with FIG. 6.

FIG. 3-4 is a flow diagram illustrating recovery according to a fifthembodiment of the invention. If unhealthy files identified by the healthcheck and clean up function 1090 can be repaired, manager 1080 sends alist of those files to agent 1010. Agent 1010 then invokes health checkand clean up function 1090 b to clean up the unhealthy files onproduction volume 1050. This fifth embodiment will be discussed infurther detail in conjunction with FIG. 7.

FIG. 4 is a flowchart illustrating a method 4000 for volume health checkand recovery. Manager 1080 gathers (4010) information on the targetproduction volume 1050. This information includes pair ID; pair group;pair name; file system; device name; mount point; hostname; andapplication type, etc. The manager 1080 then sends this information toagent 1010 via logical data connection 1150 so that agent 1010 can takea snapshot of production volume 1050.

Agent 1010 then does preprocessing (4020) for splitting the mirroredpair (e.g., production volume 1050 and snapshot mirrored volume 1110).For example, if the application 1020 type is flat file, then agent 1010can freeze or lock target files or volumes. If the application 1020 typeis database, then agent 1010 can invoke an online backup mode for theapplication 1020.

Agent 1010 then splits (4030) the mirrored pair and informs manager 1080to mount the snapshot mirrored volume 1110 on backup management server1070. Manager 1080 then mounts (4040) snapshot mirrored volume 1110 onbackup management server 1070, if necessary. After mounting (4040),manager 1080 invokes the health check and clean up function 1090 tocheck (4060) the health of the snapshot mirrored volume 1110, which isidentical to production volume 1050. Accordingly, a problem withproduction volume 1050 will be mirrored at snapshot mirrored volume1110.

If the health check (4060) indicates that the snapshot mirrored volume1110 is healthy, then manager 1080 performs post-processing (4090),which may include unmounting the snapshot mirrored volume 1110,resynchronizing, and updating backup table 1095. The method 4000 thenends.

If the health check (4060) indicates that the snapshot mirrored volume1110 is unhealthy (e.g., data corruption, infected with a virus, etc.),which indicates that production volume 1050 is unhealthy, then manager1080 alerts (4070) an administrator that snapshot mirrored volume 1110or a file on volume 1110 is not healthy via an email message, display ona screen, or via other techniques. Manager 1080 then invokes healthcheck and clean up function 1090 to clean (e.g., recover, repair, etc.)production volume 1050 via one or more methods as will be discussedbelow in conjunction with FIG. 5, FIG. 6 and FIG. 7. Method 4000 thenproceeds to post-processing (4090) as discussed above.

FIG. 5 is a flowchart illustrating method 5000 for recovery using thefirst and second embodiments. Manager 1080 determines (5010) if thesnapshot mirrored volume 1110, which is identical to the productionvolume 1050, can be cured. If the snapshot mirrored volume 1110 cannotbe cured, then manager 1080 chooses (5040) healthy snapshot mirroredvolume 1120 per backup table 1095. In addition, the manager 1080notifies agent 1010 of the chosen snapshot mirrored volume 1120. If thesnapshot mirrored volume 1110 can be cured, then manager 1080 invokesthe health check and clean up function (1090) to clean up (5020) thesnapshot mirrored volume 1110. The manager 1080 then unmounts (5030) thecorrected snapshot mirrored volume 1110 from backup management server1070 and notifies agent 1010 that snapshot mirrored volume 1110 has beencorrected.

After either choosing (5040) or unmounting (5030), agent 1010 unmounts(5050) the production volume 1050 from production server 1000. Agent1010 then resynchronizes (5060) the mirrored pair using snapshotmirrored volume 1110 if it has been corrected or snapshot mirroredvolume 1120 if volume 1110 could not be corrected, thereby restoringproduction volume 1050 to a healthy state. After resynchronizing (5060)agent 1010 mounts (5080) the production volume 1050 again and splits(5070) the mirrored pair to keep the snapshot mirrored volume (1110 or1120 depending on which one was used) healthy. The method 5000 thenends.

FIG. 6 is a flowchart illustrating a method 6000 for recovery using thethird and fourth embodiments. Manager 1080 determines (6010) ifunhealthy (e.g., infected, corrupted, etc.) files on snapshot mirroredvolume 1110, which are identical to unhealthy files on production volume1050, can be cured. If the files cannot be cured, then manager 1080chooses (6040) a healthy snapshot mirrored volume 1120 that has healthyversions of the file per backup table 1095 and notifies agent 1010 ofthe file names and locations. If the files can be cured, then manager1080 invokes the health check and clean up function (1090) to clean upthe unhealthy files on snapshot mirrored volume 1110 and notifies agent1010 of the file names and locations. Manager 1080 then unmounts (6030)the snapshot mirrored volume 1110 from backup management server 1070.

After either choosing (6040) or unmounting (6030) agent 1010 mounts(6050) the healthy snapshot mirrored volume 1110 or 1120 onto productionserver 1000. Agent 1010 then copies the healthy files from eithersnapshot mirrored volume 1110 or snapshot mirrored volume 1120 toproduction volume 1050, thereby replacing the unhealthy files onproduction volume 1050 with healthy files. Agent 1010 then unmounts(6070) the healthy volume (1110 or 1120) from the production server1000. The method 6000 then ends.

FIG. 7 is a flowchart illustrating a method 7000 for recovery using thefifth embodiment. Manager 1080 sends (7010) a list of unhealthy files toagent 1010 on the production server 1000 and unmounts (7020) thesnapshot mirrored volume 1110 from the backup management server 1070.Agent 1010 then performs preprocessing (7030) such as lockinginput/output to unhealthy files on production volume 1050. Agent 1010then invokes health check and clean up function 1090 b to clean up(7040) the unhealthy files on production volume 1050. Agent 1010 thenperforms post processing (7050), such as unlocking input/output to thecleaned up files. The method 7000 then ends.

FIG. 8 is a diagram illustrating a backup table 1095. The table 1095includes information on Pair ID 8010; Pair Group 8020; Pair Name 8030;Production Volume (Physical) 8050; File System Type (8060); Suspended(Backed Up) Date 8070; Device Name (logical) for Production Volume 8080;Device Name (logical) for paired volume 8090; Mount Point 8100;Production Host 8110; and Application Type 8120 (such as DB, SQL server,DB2, etc.).

Accordingly, the systems and methods of the present invention enablehealth checks of a production volume by checking the health of asnapshot mirrored volume. This enables checking the health of theproduction volume without disturbing access to production volumes. Inaddition, this enables optimal use of backup volumes by cleaning upunhealthy snapshot mirrored volumes or marking them as unhealthy so thatthey can be rewritten.

The foregoing description of the illustrated embodiments of the presentinvention is by way of example only, and other variations andmodifications of the above-described embodiments and methods arepossible in light of the foregoing teaching. For example, anadministrator can specify which files and/or volumes to use whensnapshot mirrored volume is uncorrectable (in place of manager 1080).Although the network sites are being described as separate and distinctsites, one skilled in the art will recognize that these sites may be apart of an integral site, may each include portions of multiple sites,or may include combinations of single and multiple sites. Further,components of this invention may be implemented using a programmedgeneral purpose digital computer, using application specific integratedcircuits, or using a network of interconnected conventional componentsand circuits. Connections may be wired, wireless, modem, etc. Theembodiments described herein are not intended to be exhaustive orlimiting. The present invention is limited only by the following claims.

1. A system coupled to a production computer via a network, the systemcomprising: a production volume storing write data from the productioncomputer; a snapshot volume storing a snapshot image of at least aportion of the production volume for a specific point in time; and amanagement computer having the snapshot volume mounted thereon; whereinthe management computer is operable to detect a health of the snapshotimage and determine a status of the production volume based on thedetected health of the snapshot image, and the management computer isoperable to present information associated with the determined status ofthe production volume.
 2. The system of claim 1, wherein the managementcomputer is operable to determine that the status of the productionvolume is unhealthy upon detecting that the snapshot image is corrupted.3. The system of claim 1, wherein the management computer is operable todetermine that the status of the production volume is unhealthy upondetecting that the snapshot image is infected with a virus.
 4. Thesystem of claim 1, wherein prior to determining the status of theproduction volume, the snapshot volume is split from the productionvolume.
 5. The system of claim 1, wherein the management computer isoperable to communicate the determined status of the production volumeto the production computer.
 6. The system of claim 1, wherein themanagement computer is operable to communicate the determined status ofthe production volume to an administrator.
 7. The system of claim 1,wherein upon the determination that the production volume is unhealthyand that the production volume cannot be repaired, the managementcomputer is further operable to locate a second healthy snapshot volumestoring a second snapshot image of at least a portion of the productionvolume for a specific point in time and to cause the healthy snapshotimage to be re-synchronized with the production volume.
 8. The system ofclaim 1, wherein upon the determination that the production volume isunhealthy, the management computer is further operable to repair thesnapshot image stored on the snapshot volume and cause the repairedsnapshot image to be re-synchronized with the production volume.
 9. Thesystem of claim 1, wherein upon the determination that the productionvolume is unhealthy, the management computer is further operable toinstruct the production computer to repair the production volume. 10.The system of claim 1, wherein upon the determination that theproduction volume is unhealthy, the management computer is furtheroperable to clean up individual unhealthy files and to cause the cleanedup individual files to be re-synchronized with the correspondingindividual files stored on the production volume.
 11. The system ofclaim 10, wherein the management computer is operable to provide to theproduction computer the location of the cleaned up individual files. 12.The system of claim 1, wherein upon determination that the productionvolume is healthy, the management computer is operable to unmount thesnapshot volume and cause the snapshot volume to be resynchronized withthe primary volume.
 13. A method for determining a status of aproduction volume storing write data from a production computer, themethod comprising: synchronizing a snapshot volume with the productionvolume, the snapshot volume storing a snapshot image of at least aportion of the production volume for a specific point in time; detectinga health of the snapshot image determining a status of the productionvolume based on the detected health of the snapshot image, andpresenting information associated with the determined status of theproduction volume.
 14. The method of claim 13, wherein the status of theproduction volume is determined to be unhealthy upon detecting that thesnapshot image is corrupted.
 15. The method of claim 13, wherein thestatus of the production volume is determined to be unhealthy upondetecting that the snapshot image is infected with a virus.
 16. Themethod of claim 13, further comprising, prior to determining the statusof the production volume, splitting the snapshot volume from theproduction volume.
 17. The method of claim 13, further comprisingcommunicating the determined status of the production volume to theproduction computer.
 18. The method of claim 13, further comprisingcommunicating the determined status of the production volume to anadministrator.
 19. The method of claim 13, further comprising, upon thedetermination that the production volume is unhealthy and that theproduction volume cannot be repaired, locating a second healthy snapshotvolume storing a second healthy snapshot image of at least a portion ofthe production volume for a specific point in time and causing thesecond healthy snapshot image to be re-synchronized with the productionvolume.
 20. The method of claim 13, further comprising, upon thedetermination that the production volume is unhealthy, repairing thesnapshot image stored on the snapshot volume and causing the repairedsnapshot image to be re-synchronized with the production volume.
 21. Themethod of claim 13, further comprising, upon the determination that theproduction volume is unhealthy, causing the production computer torepair the production volume.
 22. The method of claim 13, furthercomprising, upon the determination that the production volume isunhealthy, cleaning up individual unhealthy files and causing thecleaned up individual files to be re-synchronized with the correspondingindividual files stored on the production volume.
 23. The method ofclaim 22, further comprising providing to the production computer thelocation of the cleaned up individual files.
 24. The method of claim 13,further comprising, upon determination that the production volume ishealthy, unmounting the snapshot volume and causing the snapshot volumeto be resynchronized with the primary volume.